AgentFixboard
OpenLast checked Hermes Agent#setup#error-messages

hermes gateway status crashes on a binary launchd plist

hermes gateway status and hermes gateway install crash when ~/Library/LaunchAgents/ai.hermes.gateway.plist is Apple's binary format. The traceback is UnicodeDecodeError: 'utf-8' codec can't decode byte 0xdc in position 8: invalid continuation byte. The surfaced line is Error: Gateway inaccessible: service_identity_unverified.

From GitHub

NousResearch/hermes-agent

Issue

Difficulty
Easy
Time
~5 min
Steps
2
Fixed in
—
Last checked

Not fixed upstream yet: the issue is open. Source: issue open. Last checked 2026-10-22.

Symptom

hermes gateway status and hermes gateway install crash when ~/Library/LaunchAgents/ai.hermes.gateway.plist is Apple's binary format. The traceback is UnicodeDecodeError: 'utf-8' codec can't decode byte 0xdc in position 8: invalid continuation byte. The surfaced line is Error: Gateway inaccessible: service_identity_unverified.

Evidence what you'll see

  • head -c 8 on the plist shows bplist00. launchd_plist_is_current() reads it with plist_path.read_text(encoding="utf-8-sig").
  • The service-identity check parses the same file, so a decode failure is reported as service_identity_unverified.
  • The utf-8 to utf-8-sig change only skips a BOM and does not read binary content.

Why it happens

A binary plist is valid launchd input but is not UTF-8 text. Byte 8 after bplist00 is not a UTF-8 continuation, so a text read raises. The identity error then points at permissions instead of the definition format.

Affected versions

macOS 27.0, Python 3.14, Hermes Agent v0.22.4 (origin/main at 81a55437f3). Also hits the auto-refresh path that checks whether the installed definition is stale. The original report is issue #90606.

Fix steps

0 of 2 done

Your check marks stay in this browser only.

How to check it worked

  • After that conversion, hermes gateway status returns without UnicodeDecodeError: 'utf-8' codec can't decode byte 0xdc in position 8 and without service_identity_unverified.

If it still fails

  • Pull request 90603 is still open. A text compare of XML dumps reports every current install as stale, because plistlib.dumps(..., FMT_XML) reindents with tabs and sorts keys.
  • The linked issue does not give a released tag that reads binary plists structurally. PATH in EnvironmentVariables is expected to differ from the invoking shell.

Sources and credit

Summarized in our own words from these public reports. Credit goes to their authors.

Provided as is, without warranty. Try changes in a non-production environment and back up first. Security-related steps: verify against the official docs. Terms · Request removal or attribution change

Hit an error we don't cover? Submit it